Site-to-site VPN troubleshooting (IPsec)

Skills you'll practise

• Describe how IKE builds the IKE SA and child SAs and which ports and protocols each uses
• Identify from logs whether a tunnel fails at authentication, proposals or traffic selectors
• Explain why NAT traversal, NAT exemption and return routes matter once the tunnel is up
• Choose the smallest safe fix for a tunnel that is up but doesn't pass a subnet's traffic

Course outline

1. 1.Troubleshooting site-to-site IPsecVideo · 2 min
2. 2.How an IPsec tunnel comes upLesson · 15 min
3. 3.Reading tunnel status and logsLesson · 15 min
4. 4.Traffic problems after the tunnel is upLesson · 15 min
5. 5.Site-to-site VPN troubleshooting (IPsec): knowledge checkKnowledge check · 17 questions
6. 6.Site-to-site VPN troubleshooting (IPsec): practical exerciseKnowledge check · 1 question
7. 7.Half of Plant 2 can't reach HQScenario
8. 8.Final exam8 questions · passing it completes the course, so people who already know the material can test out

Sources it draws on

The lessons and questions are written from these references, so learners can go back to the original.

• RFC 4301: Security Architecture for the Internet Protocol
• RFC 7296: Internet Key Exchange Protocol Version 2 (IKEv2)
• RFC 3948: UDP Encapsulation of IPsec ESP Packets
• RFC 4303: IP Encapsulating Security Payload (ESP)